brig sandbox flaw: a symlink in the project folder exposes host directories

What is this?

brig is an open-source Go tool that runs AI coding agents inside a sandbox, with a microVM mode for hardware-level isolation, so an agent only sees the project it is given. On 26 September 2026 the maintainers published advisory GHSA-wp6x-29qx-fpr7, and Endor Labs described the finding in a write-up dated 28 September 2026. The flaw is a symlink traversal in how brig mounts the project directory. This article summarises already-published, patched research; it does not describe a new attack.

How it works

brig validated the workspace mount but passed the project path to the container runtime without resolving it. The runtime then resolved that path on the host, outside the sandbox. Because the agent has read-write access to the project, it can replace a subdirectory with a symlink pointing at another host directory. Nothing happens at that point. The link only matters when the operator later runs brig on that subdirectory: the host-side runtime follows the link and mounts the target read-write into the sandbox.

The authors classify this as link following (CWE-59) with brig acting as a confused deputy. They state that it is not a hypervisor or guest-kernel escape; the isolation layers held, but the path handling handed the sandbox something it was never meant to receive. In the run summary, the project row displayed the path the user typed rather than the directory it resolved to, so the redirection was invisible to the operator.

Why it matters

Reachable locations depend on the privileges of the user running brig, and could include SSH keys, cloud credentials and other projects. The advisory rates it High (CVSS 8.2) because the scope changes: a sandbox meant to contain the agent reaches host data. It also illustrates a broader pattern seen in coding-agent tooling this autumn: the sandbox boundary is only as strong as the code that prepares it, and files the agent can write are untrusted input to that code.

Defenses

• Upgrade to brig 0.3.0. The fix opens the project one path component at a time, refuses symlinks below the first user-writable directory, verifies each opened entry, and shows the resolved directory in the run summary.
• If you cannot upgrade, resolve the full project path before running (for example with pwd -P) and pass the real directory.
• Check every path component, not just the last one; a link can appear at any level.
• Treat any directory the sandbox can write to as attacker-influenced when a privileged tool later reads it.
• Run sandbox runners as a dedicated low-privilege user so a mis-mounted directory exposes as little as possible.
• Keep credentials out of home directories that a sandboxed workflow could be pointed at.

Status

Item	Detail
Product	brig (github.com/brig-sh/brig)
Affected versions	Below 0.3.0
Fixed in	0.3.0
Advisory published	26 September 2026 (GHSA-wp6x-29qx-fpr7)
Write-up	28 September 2026 (Endor Labs)
Severity	High, CVSS 3.1 score 8.2
CVE	None assigned at the time of the advisory